Self-Testing of Quantum Circuits 



Frederic Magniez * Dominic Mayers ' Michele Mosca * Harold Ollivier 



Abstract 

We prové that a quantum circuit together with measurement apparatuses and EPR sources 
can be fully verified without any reference to some other trusted set of quantum devices. Our 
main assumption is that the physical system we are working with consists of several identifiable 
sub-systems, on which we can apply some given gates locally. 

To achieve our goal we define the notions of simulation and equivalence. The concept of 
simulation refers to producing the correct probabilities when measuring physical systems. To 
cnable the efncient testing of the composition of quantum operations, we introduce the notion 
of equivalence. Unlikc simulation, which refers to measured quantities (i.e., probabilities of 
outeomes), equivalence relates mathematical objeets like states, subspaces or gates. 

Using these two concepts, we prové that if a system satisfies some simulation conditions, 
then it is equivalent to the one it is purposed to implement. In addition, with our formalism, we 
can show that these statements are robust, and the degree of robustness can be made explicit 
(unlike the robustness results of |DMMS0Ü| h In particular, we also prové the robustness of the 
EPR Test |MY98| . Finally, we design a test for any quantum circuit whose complexity is linear 
in the number of gates and qubits, and polynomial in the required precision. 

1 Introduction 

We develop techniques for verifying the operations that a given set of quantum gates perform. We 
consider "self" -tests, which are tests using the given set of gates without reference to some other 
trusted and already characterized quantum devices. This notion was initially defined for classical 
programs BK95 ( BLR93 . Self-testing was then extended to quantum devices {MY981 DMMSOO 
and to quantum testers of logical properties |BFNR,f)3| [FMSS03 . 

The work by Mayers and Yao MY98 focuses on testing entangled EPR states shared between 
two distinguishable locations, A and B. Apart from assuming the Standard axioms of quantum 
mechanics, the main assumptions they exploit are locality in the sense that the measurements at A 
commute with the measurements at B (i.e., no instantaneous signaling); and that one can perform 
independent repetitions of the same experiments, in order to gather statistics (i.e., the apparatuses 
have no memory of previous runs of the experiments). However, they do not assess the robustness 
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of their results (i.e., they do not claim that if the state satisfies the required statistics with precision 
e then the state is within e^ 1 ) of an EPR state). Robustness is nonetheless an interesting property 
very much worth studying for practical reasons: first, one can never learn any statistics with 
infinite precision by sampling only; second, by their very nature, physical implementations are only 
approximate. 

The work of Van Dam, Magniez, Mosca and Santha .DMMSOO) focuses instead on testing gates. 
They make a number of assumptions, including (and in addition to assuming the Standard axioms 
of quantum mechanics) (1) the ability to repeat the same gate in the same experiment; (2) the 
absence of memory in the apparatus between different experiments; (3) the ability to prepare and 
measure '0' and '1'; (4) the locality of each of the gates (i.e., they only affect the qubits they 
are suppose to act upon); and (5) the dimension of the physical qubits (i.e., 2-level systems). Of 
these assumptions, the last one is certainly the most unrealistic one, but also the most crucial one. 
Relaxing it allows for "conspiracies" that can spoof the test, and it is not so clear how to work 
around them (See Appendix^for an example given by Wim van Dam). 

This paper improves upon the Mayers and Yao results [MY98| by making them robust. It also 
improves upon the Van Dam, Magniez, Mosca and Santha paper DMMSOO by removing the need 
for assumptions (1), (3) and (5). Some version of assumption (2) seems necessary. We suspect, one 
might be able to relax assumption (4) to some extent, but we keep a version of it in this work. 

We have sketched the assumptions of the previous work that we do not wish to make. Let us 
now detail the assumptions that we do make. We assume that, (HI) the physical system we are 
working with consists of several identifiable sub-systems; (H2) two subsystems interact only if we 
are applying a gate that has both those subsystems as input; (H3) each gate will behave identically 
in each experiment it is used in (i.e., each gate is some fixed completely positive superoperator); 
and (H4) classical computation and control are perfect and can be trusted (e.g., classical control 
has no side-channel) . 

Our procedure allows us to test physical implementations of unitary gates, EPR creation gates, 
and one-qubit projective measurements. A more general superoperator can be tested by viewing it 
as a composition of operations of the above form. 

There is however one important restriction to the class of gates we are able to test. The ideal 
gates must have real valued coefficients. Note that we are not making any assumptions about the 
physical implementation of gates, but rather on the ideal gates they are supposed to simulate. We 
are merely saying that we do not have a procedure for verifying that a physical gate is equivalent 
to a complex gate. This is not for a lack of trying. The problem is that any complex gate of 
dimension d can be simulated using quantum systems of dimension 2d, real gates and appropriate 
measurement devices, in a rather Standard way |RG02j . On the positive side, this remark means 
that our restriction is not a limitation. But, this also means that one cannot teli if a gate is 
complex or simulated by a real one without external help (e.g., knowledge of the dimensionality 
of quantum systems, trusted one-qubit measuring apparatuses, etc). More importantly, given any 
set of quantum gates, and a set of experiments attempting to characterize those gates, there is a 
corresponding set of real gates that would produce identical predictions. However, these two sets of 
gates are not equivalent according to the natural notion of equivalence we define (which is a type of 
local unitary equivalence). That is, we believe that such gates cannot be trusted in a cryptographic 
context without further assumption. The reason is that although the real-gate simulations of the 
complex gates yield identical outcome probabilities, an adversary might be able to take advantage 
of the structure of real-state simulations in order to extract information on the quantum operations 
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being performed. 

Our first contribution (Section EJ) is to propose a theory of self-testing by introducing appro- 
priate notions such as simulation and equivalence. Unlike simulation, which refers to measured 
quantities (i.e., probabilities of outcomes), equivalence relates mathematical objects like states, 
subspaces or gates. Equivalence is meant to relate objects with similar observable properties. 
Therefore, we have based this notion on the existence of unitary transformations that map states 
and operations onto their respective ideal version. Our notion preserves the inner product and 
hence the distinguishability of quantum states, which is a crucial tool for assessing the security of 
physical implementations of most quantum cryptographic protocols. 

Our second contribution (Section |3J) is a characterization of unitary gates and circuits. Namely, 
we explain how simulation implies equivalence. The main tool for thwarting conspiracies is the 
Mayers-Yao test of an EPR pair. We will build upon the fact that one way of preparing trusted 
random BB84 states is to first prepare an EPR state, transmit one half, and independently measure 
the other half. We will show that this method can be generalized and yields trusted input states 
to be used in conjunction with self-testable quantum circuits. 

Our last contribution (Section0J) is to prové the robustness of our characterization. In particular, 
we show that the EPR test of MY98 is robust. Using the concepts of simulation and equivalence, 
such proofs are not so difficult although the robustness of the EPR test had been left open. The 
crucial point was to realize that the robustness of our characterization needs only to be stated on 
a rather small subspace in order for it to be of practical interest. 

The important consequence of our study is the possibility of defining a tester (Section EJ) that 
might be used in real-life situations. Contrary to tomography which requires trusted measurement 
devices and an exponential number of statistics to be checked, our test has a complexity linear in 
the number of qubits and gates involved in the circuit, and polynomial in the required precision. 
We describe our tester with an example and in a general context. 

2 Testing Concepts 
2.1 Notation 

In this section, we describe our theory of testing using a fixed integer N as parameter. Later in 
the paper, we will set N = 2 as it will correspond to the case of qubits. For an introduction to 
quantum computing, we refer the reader to |NC00l IKSV02| . 

We denote by U(N) the set of unitary matrices of size N, U{H) the set of unitary transformations 
on the Hilbert space H, and 2(H, H') the set of isomorphisms between the Hilbert spaces H and 
H (with same dimension) which preserve the inner product. In case of transformations over real 
spaces, we use the notations 0{N) and O(H) instead oíLÍ(N) &ndU(H). 

For the Hilbert space TL2 we denote by |0) and |1) the computational basis, and for any qéM 
the state \a) = cosa|0) +sina|l). In particular \^) = |1). We denote by |^ + ) the EPR state 
7^(|0) <8> |0) + |1) <g> |1)). For n finite, we denote by |$+) the state corresponding to n EPR states: 

l^n) = ^E*e{o,i}"l x >®l a; >· 

For linear transformations M and M 1 on H, and a subspace S of H, the notation M =s M' 
means that the equality holds only on S. When M is a linear transformation on A, we extend M 
on any tensor product A ® B by M (g> Id#; we sometimes still denote this as M in an attempt to 
simplify our notation. 
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2.2 Simulation 



The concept of simulation formalizes the idea of producing the correct probabilities when observing 
physical systems. Observations are based on fixed experimental setups comprising measuring de- 
vices that gather information about the state of the system of interest. Likewise, the simulation of 
a state by another one will be defined with respect to projectors. These projectors are used here in 
the same way measurement devices are used in a laboratory: they act as reference systems against 
which the system of interest is tested. 

More precisely, we are given a family of projectors (P w ) w e\v acting on H, and a state 
whose purpose is to simulate the state \4>) of the canonical Hilbert space Hn = C . In the 
following definition, and throughout the rest of this paper, we implicitly use the labels w of the 
projectors P w on H to label some projectors \w)(w\ on Hn, that are assumed to be given and fixed. 

Definition 1. A quantum state \if>) € H simulates the quantum state \<j)) £ Hn (with respect to 
{P w } weW ), if \\P w m\\ 2 = IH0>| 2 , Sor every weW. 

The notion of simulation can be rephrased for a whole Hilbert space H. Let (\i))i be the 
canonical orthogonal basis of Hn, usually the computational basis. Assume we are given a family 
of states of H such that each \ipi) simulates \i) (with respect to fixed set of projectors 

{P w }we\v)- in such case, we say that (\ipi))i simulates or, when there is no ambiguity, that 
H simulates Hn- 

With this definition of simulation for Hilbert spaces, it is possible to extend the notion of 
simulation to gates. Note in the definition below that the set of projectors used to assess that H 
simulates Hn is the same as the one used to assess that G\ipi) simulates T\i). 

Definition 2. Assume that H simulates TCn-' (IV'í))* simulates (with respect to {P w } w ^y\;). 

A unitary transformation G G U{H) simulates the unitary transformation T £ U(Hn), if G\ipi) 
simulates T\i) (with respect to {P w } we y [ >), for every i. 

2.3 Equivalence 

One goal of testing is to ensure, using few resources, that a physical implementation of a circuit is 
faithful enough so that the probabilities for the final measurement outcomes are identical to those 
that would be obtained after running the ideal circuit. Unfortunately, the notion of simulation as 
defined earlier does not compose. That is, measuring probabilities for parts of the circuit does not 
guarantee that the whole will function according to its ideal specifications. To be able to compose 
statements, we introduce the notion of equivalence. 

Clearly, we want a notion of equivalence that respects the inner product of quantum states and 
that preserves the tensor product structure of the different registers. The first requirement follows 
from the fact that we want to be able to conclude that equivalence implies simulation and leads 
to an equivalence notion based on isometries or unitary transformations. The second requirement 
is imposed in order to keep a track of local transformations. This is crucial in this work since a 
series of local tests based on EPR pairs will be designed in order to test a whole circuit given by a 
sequence of local gates. It can be seen quite simply through the following example that using only 
isometries or unitary transformations does not satisfy this last property. 

Consider two 4-dimensional vector spaces A and B, and H = A® B. We identify in A (resp. 
B) two 1-qubit registers that we denote by A\ and A^ (resp. B\ and B-i). Let = \4> + }a 1 b 1 <8> 
\(P + )a 2 B2- If t ne measurements on A (resp. B) only measure the ^4i-part of A (resp. the -Bi-part of 
B), we would like to say that is equivalent to on the subspace S = {l^^iBi <£> \4> + }a 2 b 2 ■ 
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I^AiBi G A\ <g> -Bi}, since the (^2 ® -B2)-part of the system is not used. Even if there exists an 
isometry U G T(S : 7í^) such that ?7|^>) = |çí> + ) (and P a ' b =5 [/' |a, ò)(a, 6|í7) this isometry cannot 
be decomposed with respect to the tensor decomposition of H. However this is fundamental fbr 
our purposes. This justifies a more elaborated notion of equivalence where we introduce a logical 
counterpart to any Hilbert space. 

The equivalence notion we now introduce is based on the work of Mayers and Yao íMY98Í • It is a 
mathematical notion based on the possibility of transferring states which lie within a given subspace 
of H into a logical system H c prepared in a fiducial state via a joint unitary transformation. 

For a Hilbert space H, that will describe the state of our physical system, we set a logical space 
H c = TÍn and define H = H c (g) H . We consider in H c the usual canonical basis (\í))o<í<n, so 
that we have a canonical mapping between H c and Hn, between U{H C ) and U(N), and between 
0(H C ) and O(N). Note that it is more convenient to set this logical system outside the physical 
system (instead of as a subpart of it) since initially we do not know which part of the physical 
system is used for the computation. Identifying some subsystem of H as the logical space seems 
more unnatural than just adding this additional logical qubit. 

The state G H is embedded in H using the isometry: Ijj : \tp) |0) <8> \4>)- The reverse 
operation is obtained by applying: P# : \ip) tr·^ JV ((|0)(0| (8> Idij)^)). It can be checked that 
Pfflff = Idff. The operators Fh and Ih allow to identify H with the subspace |0) ® H of H. 
Similarly, any linear map M on H is extended to the linear map |0)(0| ® M on H. Thus, we will 
omit Fjj and Ih when there is no ambiguity. 

First, we define the equivalence between a subspace of H and the logical system H c with respect 
to a set of projectors. As for the notion of simulation, these projectors act as reference systems. 

Definition 3. Let U G U(H). A subspace S of H is [/-equivalent to H c (with respect to (P w ) w& w), 
if for every w G W, P w = s Piïf/ t (|u')(u'| là H )Ul H . 

The above definition is equivalent to the commutative diagram: 

S -í- ► S 

ui H ï T r H W . 

- \w){w\®ld H ^ - 

Intuitively, the unitary transformation U ensures that the correspondence between the physical 
system H and the logical system H c is well defined on S. Using this correspondence, we can now 
define the notion of [/-equivalence for states and gates. 

Definition 4. Let S be a subspace of H. A state G S is [/-equivalent to a state \<p) G H c on S 
(with respect to {P w ) w ç.y\>), if 

1. S is U -equivalent to H c , 

2. |V>) = U\\<p) for some \x) G H. 

Definition 5. Let S be a subspace of H. A unitary transformation G G U{H) is (U, ^-equivalent 
to a unitary transformation T G U(H C ) on S (with respect to (P w ) we y\>), if 

1. S is U -equivalent to H c , 

2. S' = G{S) is V -equivalent to H c , 

3. G = s V ] {T W)U, for some W G U(H). 
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This equivalence can be summarized by the following commutative diagram 

s s S' 

- \w){w\&d H - T®W fj \w)(w\®\& H 
rl > ti > tl > 

When H is explicitly decomposed into a tensor product, H = ®" =1 H % , and P w = 0™ =1 P^l, 
where w = (w 1 ,w 2 , . . . , w n ) G W 1 x W 2 . . . W n , we will often use the notion of equivalence for 
unitary matrices U that can be tensor product decomposed as U = U*, for some U l G IA{H % ). 
When we do not want to specify the decomposition of U, we will use the notion of tensor equivalence. 
Notice that for the state and transformation tensor equivalence, \x) and W are not required to be 
tensor product decomposable. This is because we want encompass situations where the physical 
implementation G of the gate creates or destroys entanglement in the hidden degrees of freedom of 
the quantum register. 

Finally, note that the tensor equivalence on H implies the equivalence for each factor Hi of 
the tensor decomposition of H, if for each factor Hi one can sum up some projections P^] to the 
identity. This will be the case in the rest of the paper. 

Proposition 1. Let H = Çfy? = iH l - Let S be a subspace of H which is ((^ Ui) -equivalent to 
H c = &>i HI with respect to (P w ) w . Assume that for every i, a subset of the projectors of {P^l )«,»ew í 
sums to the identity on H l . Then S is Ui-equivalent to H c with respect to (P^i) w i^y\;i, for every i. 
Moreover if S = (^)j5' í , where S l is a subspace of H % , then S l is Ui-equivalent to H l c with respect 
to (P^D^ewi, for every i. 

From now on, we set N = 2 when we do not explicitly state otherwise. When we omit the 
parameters U or (U, V) from the equivalence notation, we mean that there exists such unitary 
transformations for which the [/-equivalence or the (U, y)-equivalence holds. 
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2.4 EPR Test 

In this section, we summarize Mayers and Yao's results MY98 in the framework of quantum testing 
we have just introduced. Their main result MY();5 Thm. 1] will be stated in an extended form 
that is most convenient for testing several registers successively. 

From now and until the end of the paper, let Aq = {0, ^, |}, Ai = {a + § : a G Aq}, and A = 

Ao U Ai. We fix in this section (P%, P^~ n ^ 2 )aeA an d C^bj -^B^^eAi orthogonal measurements 
respectively on two Hilbert spaces A and B. Namely, we assume that P% + p^/ 2 = ld A and 
P B + Pz +7T/2 = Id B , for every a G Aq. 

Theorem 1. Let H = A (g) B (g) C , and \ijj) G H that simulates \<p + ) with respect to (Pj[ (g) Pg (g 
Idc) a ,beA- Then there exist two unitary transformations U ^ G U(A) and U§ G U{B) such that 
is {U^<S>U§)- equivalent to \4> + ) on S = span{P|(gPg ®ldc\ip) '■ a,b G .4}. Moreover the dimension 
of S is 4- 

Note that the theorem can be extended from S to the supports of \ip) on the ^4-side and on the 
-B-side using ÍMY031 Prop. 4]. Since we will only need the result on S, and because the robustness 
the EPR test is easier to state in such case, we will only state our results for S, even though all of 
them can be extended to the tensor product of the respective supports (for the exact case). 
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From Tlieorem^it is easy to derive by induction over n our main tool for testing n-qubit regis- 
ters. Let A = (g)™ =1 A* and B = ^ =l B\ we now fix Pj +7r/2 ) a i 6A) and P^ 2 )^ 
to be orthogonal measurements on A % and B l respectively for every i. We denote P\ = &™ =1 P%-, 
with a = (a*)™ =1 and P| = ®" =1 Pg< with ò = (ò*)f =1 . Note that in the following corollary, the 
tensor equivalence is with respect to the tensor decomposition A ® B, but also with respect to the 
tensor decompositions A = ®" =1 A % and B = ®" =1 B i . 

Corollary 1. Let H = A&B&C, and \%>) G H that simulates \<p + ) with respect to (Pj£ ® Pj£ <g> 
Idc)„i &i 6> 4 /or every i = 1,2, ... , re. TTien í/iere exisí íw;o unitary transformations Uj G (^) i í/(A i ) 
aneí t/g G ® i U(B i ) such that zs (U à®U g)-equwalent to |$+) on S = span{P%<S> P B \ip) : a,b G 
A n }. Moreover the dimension of S is 4 n . 

Therefore, when measurements are acting on different factors of the tensor product decompo- 
sitions of A and P, testing a 2n-qubit EPR state can be done by testing the n EPR pairs that 
are present in it. That is, by checking the probabilities of 0(n) outcomes, whereas there are 
possible joint measurement outcomes. 

3 Simulation implies Equivalence 

In this section we relate simulation and equivalence. While it is clear that equivalence implies simu- 
lation, we show below that under certain assumptions, simulation implies equivalence. To ease the 
presentation of our results, we start by describing how 1-qubit real gates, namely transformations 
in 0(2), can be tested. As a second step, we show how to test n-qubit real gates. 

3.1 One-qubit Gate Testing 

As a first attempt, we show how to test that a gate is acting as the identity. 

Proposition 2. Let H = A B and G G U(A). Let \tp) G H be such that \ip) and G\ip) simulate 
\4> + ). Then, G (g) Ids is tensor equivalent to Id J 4 c (g> Ub c on S = span{P| ® P B \ip) : a, b G A}. 

Proof. We show below that G is (C/4 (g> U B , U^G^ <g> í7^)-equivalent to Ha c <8> Idg c on S. 

First note that Lemmas Q and applied to \ip) gives C/4 and C/# such that S is (C/5 (g> C/^)- 
equivalent to A c (8) P c and C/4- ® U B \ip) = \4> + ) (g> |x) f° r some |x) in A P. We can derive that 

{U A G^U È )G\^) = \cj ) + )®\x)- 

Hence, it only remains to show that G(S) is (UjG* <8> C/^)-equivalent to A c ® P c - Let a, b, a',b' G 
A, then the following equalities hold: 

(PI 8) P|)(G 8) ld B )(PÍ p£)|V) = (M A ® P h B P%Pg)(PÍG ® Id B )|V) 

= G(8PiPè'p|'piiv) 

= (G ® Id B )(Pi P^)(PÍ p£)|</>), 

where we applied Proposition El (see Appendix lB.2|) to on the first and the last line, and to G\ip) 
on the second line. In other words, this States that (Pj£ ® Pg)(G(g)Id_B) =5 (G^Ide^Pj^Pg). Using 
U A ® C/ B to replace P^ ® P^ over 5, we get P£ ® P b B = G{S) {Gü\ ® U ] È )(\a)(a\ ® |6)(ò|)(C/^Gt ® P 5 ), 
which is the required equivalence between G(S) and A c (8) P c . □ 
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Stating the above result allows us to exhibit simple characteristics of the general method used 
for proving that gates can be self-tested. First, any gate testing requires two EPR tests. These 
are used to ensure that the input and output states together with the measurements act properly 
before and after the gate. These are "conspiracy" tests. Second, the fundamental properties of 
EPR states — namely that a given measurement can be performed on either the A-side or the P-side 
without changing the collapsed state — is used in order to show that on the input state | i/j) , the gate 
G and the measurements commute. Together with the replacement of the projectors Pj[ and P B , 
that come from the physical measurements, by their ideal versions \a)(a\ and \b)(b\ on A c and P c , 
this allows to perform the tomography of the gate G. 

We can now state the general result concerning any 1-qubit real gate. 

Theorem 2. Let T G 0(2). Let H = A® B, G A £ U(A), and G B G U{B). Let \tp) G H be such 
that \ip) and GaGb\4>) simulate \<fi + ), and such that Ga\iP) simulates (T Id2)|</> + ). Then, Ga is 
tensor equivalent to T on S = span{P A ® P B \ip) : a, b G A}. 

Proof. The proof proceeds in two steps. First, it is shown that S and G A (S) are respectively 
(Ua ® Ug)- and (Va <8> U B ) -equivalent to A c ® B c . Second, it is shown that there exists W G U(A) 
such that G A ® Id fl =s (v\ ® U ] È )(T ® W ® Id B )(U A ® E/g). 

Lemmas n an d IU applied to and GaGb|t/?) give U A ,V A G and U B ,V B G W(P) such 

that 5 1 and (G^ ® Gb)(S) are respectively (E/5 8) í/g)" and (Ka ® Vg) -equivalent to A c (g) P c . This 
implies that (Ga ® Ids)(S l ) is (V^ <8> E/g) -equivalent to A c (& B c . That is, we have the required 
tensor equivalences for S and Ga(S). If we define |x)ab as U A ® í/glV') = I<^ + )a c b c 8) |x)ab> we 
then have 5 = E/ A U B (A C ® B c ® \x)ab)- 

The simulation of T\(j) + ) by G^IV') can be rewritten within the density matrix formal- 
ism as: tr ((P% ® P b B )G A \^\G A \ = tr ((|a)(a| ® |6)(6|)(T <g> ld 2 )|0+ )(</»+ |(Tt ® Id 2 )) . Using 
the commutativity of the trace operator and (Id 2 <8> = <8> |í>)(í>|, we get 

tr ((G A P|G A ® PDlVXV'l) = | tr (T^\a)(a\T\b)(b\) . 

Define the positive semi- defmite operator R\ È = (U À ® U b )G\p%G A (U\ ® t/t). Since is 
tensor equivalent to \(f> + ), we have: tr (R a AÈ (\b)(b\ Ac ® |£>)<£>|b c ® IxXxUb)) = tr (rt|a)(a|T|ò)(ò|) . 

This can easily yield the equations required to apply LemmaElfor performing the tomography 
of R% B - For instance, observe that the operators U B and í/t can be removed from the defmition 
of R°a b without modifying it. Therefore the previous equation can be extended for all b,b' G A to 

tr (R a ÀB (\b)(b\ Ac \b')(b'\ Bc IxXxUb)) = tr (^\a){a\T) , 

since the value of the left hand side does not depend on b' . 

Now LemmaElcan be applied on A c to the operators AB(x\B c (b l \R\ B \b') b c \x) AB and T^\a)(a\T 
with n = 1 and e = 0. The conclusion is that AB(x\B c (b'\R a A B \b') b c \x) ab = (T*\a)(a\T), for every 
b' G A. Since R% B is a semi-definite operator, the above conclusion can be rewritten as 

R AB =a c ®b c ®\ x )ab ( T ^\ a )( a \ T ) ® !dA®g- (!) 
The tensor-equivalence of Ga(S) with A c <8) P c also gives 

P% =g aí s) (Va ® 4)(I°X«I ® IdA®fl)(Va ® ^b)- 
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Since S = U A ® U B (A C ® B c ® |%}), this can be used to replace P\ inside Equation We obtain 
(\a)(a\ ® Id^)^ 8) ® ^)( T t ® Id A ^ B ) 

Then, we conclude using Lemma |ïï] with e = 0, that there exists W G such that 

Ca =s (V\ ®U ] b ){T®W® ld B )(U À ® U B ). 

□ 

3.2 Many-qubit Gate Testing 

We now consider n-qubit real gates. We present our main result for testing gates using a slightly 
different formulation than in Theorem The reason for this change is that it makes the proof of 
the composition theorem (Theorem 01 used for self-testing circuits straightforward. We have also 
added an extra Hilbert space G in the tensor product decomposition of H. The proof is omitted 
since it is identical to the second step of the proof of Theorem El where a, b and b' are now in A n . 

Theorem 3. Let T G C(2 n ). Let H = A ® B ® C , where A = ®. A i and B = (g^PA Let 
G A eU{A) and Gg €U(B). Let |*) G H and U A ,V A G (g)^^) and U S ,V B G <g>iU{B~i) be such 
that: 

1. \^f) is (U A ® Ug)- equivalent to |<l>+) on 5 wní/i respect to (P A ® P B ) a ,beA n > 

2. GaGbY&) is (V À ®V§) -equivalent to |<£>+) on (Ga®G b )(S) with respect to (PjJ® P B ) a ,beA n , 

3. Ga\$) simulates (T ® Id 2 ")|$í) with respect to {P% <g> P| ® Idc) a ,be^"; 

where S = span{P| ® Pgl^) ■ a,b £ A n }. Then Ga is (U A ® ÍTg, ® U g)- equivalent to T on S. 
Using Corollary^ one can observe that this formulation is not weaker than the one of Theorem[5| 

3.3 Circuit Testing 

Now we state our main theorem and its corollary which relates the simulation of states to the 
equivalence of gates, and therefore to the simulation of gates. We omit their proof due to the lack 
of space and because they are derived easily from Corollary ^ and Theorem |31 

Assume that some Hilbert space H has a tensor product decomposition H = (g)™ =1 A 1 (g) B l . 
For any subset I Ç {1, 2, . . . , n}, let H 1 denote the Hilbert space (g) i6/ A l (g) ie/ B\ and |<I> + )j the 
corresponding EPR state l^j^) over (g) i6J A l c (g) í6 / B l c . 

Theorem 4. Let H = A® B, where A = ® i A i and B = (g) í B i . Let J 1 , J 2 , . . . , J* Ç {1, 2, . . . , n} 
bet subsets. LetG\ G U(A P ), G j B G U(B P ) andT j G 0(A P ). Let |*) G A®B. Define inductively 
= (G^Mb)!* 5 ' -1 ) and I* 5 ') = (G^ ® G^)]^ 1 ), w/íere |*°) = |*'°) = issnme í/ie 
following. 

1. |*) simulates uraí/i respect to (PÍ <8> Pgi)^ tfeA' f or ever V i = 1,2, . . . ,n. 

2. For every j = 1, . . . ,í: I*- 7 ) simulates \4> + ) with respect to (Pj^* f8)Pgi)o%6 i e^.j / or euer 2/ «GP. 

3. Por euery j = 1, . . . , í; I*'- 7 ) simulates T J |<í> + )p otí/í respect to (P° 7 j ® P^ w ) a j^/j ■ 

r/ien G^G^ 1 ■ • • G^ is íensor equivalent to T^T* -1 • • • T 1 on S 1 = span(P^ ® P||#) : a, ò G .A n ). 
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Corollary 2. Let \^f) G H that satisfies the hypothesis of Theorem^ for some decompositíon of 
Ga G M(A) an d T £ U{A C ) into t gates acting only on a constant number of qubíts. Then, for 
every x G {0, l} n , the state \/2™ trs(Pg|^)) simulates \x)a c with respect to (Pa)w£A" ■ Moreover 
Ga simulates T with respect to the above identification, and the number of statístics to be checked 
is in 0(t). 

4 Robustness of Simulation 

4.1 Norm and Notation 

We consider the £2 norm ||·|| for states, and the corresponding operator ||·|| norm for linear 
transformations. These norms are stable by tensor product composition in the following sense: 
||u(g)v|| = ||u||x||v||, ifu and v denote either vectors or linear transformations. 

We note \ip) = £ \tp') when two vectors \ip') are such that |||^) — \ip'}\\ < £■ We extend the 
^2-operator norm for restrictions of linear transformations on H. Namely if M is a linear transfor- 
mation on H, and S is a subspace of H we define by ||M||g = sup(||M|V>)|| : \ip) G S and |||V>)|| = 1)- 
Similarly to states, we will write M = £ s N when \\M — N\\g < e. 

We introduce the notion of e-simulation by extending the notion of simulation where statistics 
equalities are only approximately vàlid up to some additive term < e. The notions of equivalence 
can be similarly extended to e- equivalence, by replacing each equality =5 by = 6 S . 

We will not detail the multiplicative constants that will occur in the upper bound on our additive 
error terms, but we will use instead the notation 0{f{e)) that denotes the existence of a universal 
constant c for which the upper bound c x f(e) is vàlid. We will use the notation íí(/(e)) in a similar 
way. 

4.2 Robustness 

Until now, our interest has been focused on the possibility of self-testing a quantum circuit when 
outcome probabilities are known with perfect accuracy. To be of practical interest, our results must 
be extended to the situation of finite accuracy. We show below that it is possible and that all the 
relevant results for testing are indeed robust in the following way: if the statistics are close to the 
ideal ones, then the states, the measurements and the gates are also close to ones that are equivalent 
to the ideal ones. This notion of robustness follows the ones of Rubinfeld and Sudan RS96, Rub99 
for classical computing and of DMM SlÏ0| for quantum computing. 

One can extend quite easily Theorem ^ on the vector space S = span^^Pgl^) : a,b G A), 
which is enough for our purposes. Note that a robust version of Theorem ^ that would be vàlid 
on the tensor product of the supports of \ip) on the A-side and on the the i?-side is much more 
diflicult to state as well as inefhcient in its robustness parameter e. This is because its conclusion 
might depend on the dimensions of A and B. 

Theorem 5. Let H = A B (g) C , and \ip) G H that e-simulates \<p + ) with respect to (P| (g> P| 
ldc) a ,beA- Then there exist two unitary transformations XJ a G U{A) and U§ G U{B) such that 
is ((^(e 1 / 4 ), (Ua 8) Ug)) -equivalent to \4> + ) on S. 

The proof can be found in Appendix[Bl This result can be generalized to the case of a source 
producing a state that simulates n EPR pairs. In such case equivalence holds within 0(4: n e). 
Corollary 3. Let H = A® B ®C, where A = ^ i A i and B = (g^ B\ Let |*) G H be a state 
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that e-simulates \4> + ) with respect to (Pj£ (8 P^^^eA) f or every i = 1,2, ...,n. Then, is 
0(4 n e 1 / 4 )-egm'üa/ení to |$+). 

Another corollary that we will use in the context of circuit testing concerns the case of n sources 
of EPR pairs that are tested simultaneously. This is qualitatively different from the previous 
situation as the state \^f) that is tested is assumed to be separable across the tensor product 
decomposition of H into H l = A % ® B % . 

Corollary 4. Let H = A<g> B ®C ', where A = (g) i A i and i? = .B\ Let |^) G H be a separable 
state across the tensor product decomposition of H into Aí®Bí, and such that it e-simulates \<p + ) 
with respect to (Pj£ (8 P B \) a i tfeA) f or ever V i = 1,2, ...,n. Then, \ i $>) is O {ne 1 equivalent to 

The proof of these two coronaries can be found in Appendix [B] Now we concentrate on the 
robustness of Theorem |3]which is proven in AppendixO Note that the exponential dependency in 
the number n of qubits it not a constraint, since we will use this theorem for constant n only (i.e., 
we assume an upper bound on the number of qubits affected by a gate, say n < 3). 
Theorem 6. Let T G 0{2 n ). Let H = A (g> B ® C , where A = ® f A i and B = B i . Let 
G A £U{A) andG B €U{B). Let G H and U A ,V À G and U B ,V B G 0^(5*) òe snc/i 

í. 1^) is (e, (8) Ug))- equivalent to |$+) on 5 otí/i respect to (P| (8 Pjj)a,6e.A n > 

g. GU (g) ïs (e, (V^ <8 Vg)) -equivalent to |<£>+) on (GU <S> G B )(S) with respect to (P% (8 

Pe)a,fce.4"> 

3. Ga\%) e-simulates (T <8 Id 2 ™)|$^) otí/í respecí to (P| <8 P| <8 ld c ) a ,b&A n ■ 
Then G A <8 Id B ís (2° ( ^·y/e, (17^ (8 U È , V À (8 U È ))- equivalent to T (8 Id 5c on 5. 

5 Testing a Circuit on a Specific Input 
5.1 Construction 

The assumptions we have made so far for gate testing are allowing very broad and genèric conspir- 
aries. For instance, the behavior of a gate can depend on previously applied gates in the circuit. 
Hence, it is impossible to have a fixed finite set of tests for characterizing the individual gates and 
then trust that the composition of these gates in a circuit will correctly simulate the ideal circuit. 
In other words, any circuit used for computation must be part of some tests. 

Surprisingly, it is much easier to test the simulation of a circuit on the subspace S than on a 
particular input. In fact, using EPR pairs allows for the simultaneous testing of all possible inputs, 
while making the selection of a particular one dimcult. The obvious choice would be to post-select 
the outcome of the P-side measurements of the EPR pairs. Unfortunately, the selected input state 
would then be prepared with exponentially small probability. However, it is dimcult to imagine 
being rid of EPR pairs as they appear to be the only kind of states that can be trusted and yet 
allow emcient gate testing. 

We circumvent the aforementioned difficulty using the fact that our circuits can have classically 
controlled feedback that decides which gates need to be applied based on some measurement results. 
More precisely, given a circuit for a unitary transformation T and an input x, we first measure the 
.B-side of the (alleged) EPR states. This yields a classical state y on the A-side. Second, we design 
a circuit T x>y whose purpose is to flip the corresponding bits of y in order to get the input x, and to 
apply the initial circuit for T. Third, we run the modified circuit on the state y that was prepared 
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on the ^4-side. Finally, we test that this modified circuit implemented the correct computation. 
This includes verifying the gates and the preparation of all input states \x') — and in particular the 
preparation of \x) — obtained by measuring |^) on the B-side. 

5.2 An Example 

As a simple example, in Figure^we consider a small 2-qubit circuit that requires all-zeros as input. 

We first run the computation (Experiment 1) once. Suppose the intermediate measurements 
on the B-side yield the outcomes M\,Mi, G {0, 1}, as indicated in the diagram. The measurement 
outcomes determine whether N° = I or N 1 = N were applied to the other halves of the (alleged) 
EPR pairs, in order to prepare '0' inputs for the initial circuit we intended to run. 

We now wish to check that the output of the circuit is correct. We carry on implementing 
Experiments 2 through 8 each a number of times in log(n/7)/e 8 , where e is the required precision 
and 7 is some confidence parameter. In general, the number of different circuits to be run is linear 
in t + n, where t is the number of gates in the circuit and n is the number of qubits of the circuit, 
so we consider the test to be efficient. 

The test circuits correspond to two independent sub-circuits being run on separate halves of 
n EPR pairs. While the gate G\ is purposed to implement the i-th step of the circuit, the gate 
G l B should undo G l A (by implementing the transpose gate). There are two types of tests. The 
"conspiracy tests" (Experiments 2,4,6,8) verify the effective dimension of the Hilbert spaces to be 
2 for each computational qubit system at each step of the circuit, and the "tomography tests" 
(Experiments 3,5,7) are characterizing the unitàries to confirm that they are the correct ones. 
Since the systems on each half of the test circuit never interact again, the gates on each side cannot 
"know" if they are in a conspiracy test, a tomography test, or the actual computation. 

Thus, if all the conspiracy and tomography tests are passed, we are confident that the actual 
computation was carried out faithfully, and any ancillary states are not entangled with the output 
of the ideal circuit. 

5.3 The genèric Test and its Analysis 

The parameters of our test is a circuit for T 6 U(2 n ), that is a gate decomposition T^T* -1 • • • T 1 = T; 
a binary string x £ {0, l} n ; a precision e > 0; and a confidence 7 > 0. We assume that each gate 
T l acts on a constant number of qubits (say < 3). The input is a source of quantum states 
spread over n pairs of quantum registers; gates G\ and G B acting on the same register numbers as 
T 3 , for every j; auxiliary gates N A acting on the i-th register of A; and orthogonal measurements 

(P^i, P^ 7r ^ 2 )aeA) an d (-Pg*' ^bí* )b£<Ao' ^ ne S oa ^ ^ s ^° * es ^ that, firstly, \/2^ tvB(P B \^)) simulates 
\b) and that, secondly, the implemented circuit Ga simulates T. 
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Figure 1: The difïerent experiments to test the circuit consisting of gates G\G 2 A G\ on input |00). 



Circuit Test (T 1 , T 2 , . . . , T* G W(2 n ), x G {0, 1}", e > 0, 7 > 0) 

1. Prepare a state of n EPR states into n pairs of registers A 1 (£> B 1 , . . . , A n (g> P ra 

2. Observe the P-side of |*) using the orthogonal measurement (Pg)be{o,-rr/2} n an d let y be the 
outcome 

3. Let T x ^ y be the circuit that changes the input \y) into \x) (using some NOT gates), and then applies 
T 

4. Prepare on the A-side the circuit Ga implementing T x>y with respect to its gate decomposition 
using the t gates of G 3 A and at most n gates of N\. Let t' < t + n be the total number of gates. 

5. Run the circuit on the j4-side and measure the outcome using the orthogonal measurement 

(PD a£{0,7r/2} n 

6. Approximate all the following statistics by repeating Q( log ("/ 7 ) ) times the following measurements 
(where we use the notation of Theorem^J: 



(a) Measure with respect to (PJJ* £g> Pgi) a * ^eAat f° r cver y i = 1, 2, 



,,n. 



(b) For every j = 1, 

(c) For every j = 1, 



, t': Measure \^ J ) with respect to (PjL ® Pj 



,t': Measure |*°) with respect to (P^ 
7. Acccpt if all the statistics are correct up to an additive error e 



) a \b i eA: for ever y * e / - 7 · 

pf) \ 



Theorem 7. Let T 1 ,T 2 , . . . ,T* G U(2 n ), x £ {0,l} n ,e > 0,7 > 0. 

// Circuit Tesí(T 1 , T 2 , . . . , T*, ce, e, 7) accepts then, with probability 1 — 0(7), í/&e outcome 
probability distribution of the circuit (in step\^) is at total variance distance 0((t + n)X 8 ) from 
the distribution that comes from the measurement ofT t T t ~ í ■ ■ • T l \x) by (|a)(a|) a6 | 0j7r /2}" • 
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Conversely, if Circuit TestiT 1 , T 2 , . . . , T 4 , x, e, 7) rejects then, with probability 1 — 0(7), °-t 
least one of the state \^f), the gates G A ,G B and N A is not 0{e)- equivalent to respectively either 
\*$)> (\ a )( a \A0aeA,(\b)(b\ B i c ) bEA ), T^T 1 ) andNOT Al , on S = span(Pl ® P||#) : a,b e A n ) with 
respect to the projections (P A (g> P^a^e-A™- 

Moreover Circuit TestiT 1 , T 2 , . . . , T*, x, e, 7) consists of 0(^r log(n/7)) samplings. 

Proof. We first describe the use of the hypotheses we made in Section^on our testing model. The 
assumption (H4) of trusted classical control is used to ensure that the circuit has the same behavior 
on P B \*&) as it would have on \^f). Hypothesis (H3) implies that we can repeat several times the 
same experiment, and hypotheses (HI) and (H2) allow us to state which parts of our system are 
separated from the others. 

First, using the Chernoff-Hoeffding bound, we know that the expectation of any bounded ran- 
dom variable can be approximated within precision 0(e) with probability 1 — 0(7) by log Q/ 7 ) 

independent samplings. Moreover if the expectation is lower bounded by a constant, then log ^ 7 · ) 
independent samplings are enough. In our case, the random variable is the two possible outcomes 
of a measurement. Call them or 1. Since we can count both and 1 outcomes, one of the cor- 
responding probabilities is necessarily at least 1/2. Therefore we get that each statistics we have 
from Circuit Test are approximated within precision 0(e) with probability 1 — 0(7). From now 
on, we assume that each statistics has been approximated within this precision. 

The second part of the theorem is the soundness of Circuit Test. We prové it by contraposition. 
Namely, if our objects are at distance at most e from ones that exactly satisfies the statistics, then 
their own statistics has a bias which is upper bounded by 0(s), thanks to the statistics properties 
of ^2-norm on states and the corresponding operator norm. 

The rest of the proof now consists in proving the first part of the theorem, that is the robustness 
of Circuit Test. We first derive the correct simulation of the implemented circuit using the 
approximate version of Corollary |21 that we get using Theorems El and El More precisely, using 
Corollary 2] for the initial source we get that is 0(ne 1 / 4 )-equivalent to on S. For other 
steps, due to the application of the j-th gate, the state \ ^ J ) is not necessarily a separable state across 
the n-registers. So we apply Corollary |3] on the registers where the j-th gate is applied, that is on 
a constant number of register, which gives the required 0(e 1 / 4 )-equivalence on the corresponding 
registers. Then Theorem |ïï] concludes that the j-th. gate is 0(je 1//8 )-equivalent to the expected 
one, similar ly for the intermediate states of the circuit and for the measurements. Note the error 
propagation is controlled by two properties: the stability of the £2 operator-norm by tensor product 
composition, and the triangle inequality of the norm. 

Now we focus on the run of T x>y in Step|SJ First we justify that the (normalized) outcome state 
\^2™P B '\^) G S of the measurement (-PB)&e{cW2} n is 0(ne 1 ^ 4 )-equivalent to \y) with respect to 
(^A)ae{o,7r/2} n 011 Pb{S)- Remind that by assumption the initial state |^) is separable across the 
n pairs of registers, namely \^) = with £ A 1 <g> B l . For each pair of registers A l ® B l , 

using TheoremElwe get that |^*) is 0(e 1//4 )-equivalent to |^ + ) with respect to {P% <S> Ps^a^b^A 
on S % = span(P^- (g) P B \\il) 1 ) : a l , & A). In particular the projections Pj£ ® P h B \ are also 0(e 1 / 4 )- 
equivalent to (a'Xa*! <8> \jo % )^b % \ on S\ Therefore the normalized outcome state V%P B (which 

is in S l ) is 0(e 1 / 4 )-equivalent to \y l ) with respect to (P^)a í e{o,7r/2} on Pb^^ 1 )- We then get our 
equivalence for the whole outcome state using those intermediate equivalences together with the 
stability of the £2 operator-norm by tensor product composition, and the triangle inequality of the 
norm. 
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Lastly, we combine the above approximate equivalences, one for the circuit and one for the 
input, and get that the outcome distribution is at total variation distance at most 0({t + nje 1 / 8 ) 
from the expected one. □ 
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A A Conspiracy for the Hadamard Test of jDM MSOOj 



This example is due to Wim van Dam. Consider the test for the Hadamard gate of [DMMSOQ]. It 
essentially consisted of verifying that starting with |0) or |1) followed by a Hadamard gate and a 
measurement resulted in a 50% — 50% distribution of '0' and '1' outcomes, and starting with |0) 
followed by two Hadamard gates and a measurement resulted in a '0' outcome 100% of the time. 

A very simple conspiracy (i.e., alternative explanation of the gate action that is not equivalent 
to the claimed action) that foils this test is the following. The qubit system is actually a 4-state 
system consisting of two qubits. Our alleged |0) state corresponds to 1 00) , and our alleged |1) 
state corresponds to |11). The alleged Hadamard gate simply maps 1 00) i— > |01), |01) \—* 1 00) , 
|11) i— ► 1 10) , 1 10) i— ► |11). In other words, our alleged |0) + |1) actually corresponds to 1 01) and our 
alleged |0) — |1) actually corresponds to |11). Our measurement operation simply outputs one of 
the two bits at random. So measuring 1 00) always results in '0', measuring 1 1 1 ) always results in 
'1', and measuring 1 01) or 1 10) results in '0' or '1' each with probability ^. 

Note that this physical system would pass the test of DMMS00 for the Hadamard gate, but 
clearly the system is not implementing the Hadamard gate. For example, if this apparatus were 
being used to implement the quantum key distribution of BB84 , the result would be disastrous 
since a competent eavesdropper could reliably distinguish all four states. It is imperative for truly 
secure the quantum key distribution of [BB84j that the qubits Alice sends are truly residing in a 
2-dimensional Hilbert space with no crucial information leaked in extra degrees of freedom or "side 
channels" . 

B EPR test and its Robustness 

In this section we sketch the proof of TheoremQ so that we can justify its robustness. 

The proof proceeds with two main steps. The first step proves the existence of a strong equiva- 
lence, a notion we define next. The second shows that this strong equivalence implies the required 
tensor equivalence. 

B.l Strong equivalence 

Intuitively the strong equivalence states the existence of an isometry between the ideal system 
and the physical system. Contrarily to the previously defined notion of equivalence, this does not 
require the use of an auxiliary system (see Definition E| . 

Definition 6. Let S be an N-dimensional subspace of an Hilbert space H , and U £ I(S,TÍn)- We 
say that S is strongly [/-equivalent to Hn (with respect to (P w ) w( zyy) if S is P w -ínvariant (that is 
P W (S) ÇS) and P w = s UÏ\w)(w\U, for every w. 

The above definition is equivalent to say that the following diagram is commutative: 



Now, we can define the strong equivalence between two states and between two unitary trans- 
formations. 



S 
Ui 

Hn 




S 

T f/t 
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Definition 7. Let S be a subspace of H. A state \ifi) £ S is strongly [/-equivalent to a state 
\4>) £ TÍn on S (with respect to (P w ) w< =.\y), if 

1. S is strongly U -equivalent to TÍn 

2. |^> = 

Definition 8. Let S be a subspace of H. A unitary transformation G E U{H) is strongly (U, V)- 
equivalent to a unitary transformation T £ UÍTÍn) on S (with respect to (P w ) w çyy), íf 

1. S is strongly U -equivalent to TÍn, 

2. S' = G(S) is V -equivalent to TÍn, 

3. G= S V^TU. 

B.2 Outline of the proof of Theorem [T] 

This theorem is essentially obtained by proving two intermediate lemmas. The flrst one states that 
\tp) is strongly equivalent to \(p + ) without reference to the tensor product structure of H = A ® B. 
The second one recovers this structure and ends the proof. 

Lemma 1. Let S = span((P| (g) P B <S> ldc)\ip) '■ a,b £ A). Under the hypothesis of Theorem^ 
there exists an isometry U £ T(S,TÍ4) such that \ip) is strongly U -equivalent to on S. 

This result is obtained in three steps. First the state satisfies the main property of any EPR 
state: the outcome state does not depend on which side the measurement is performed. 

Proposition 3 (|MY03, Prop. 1]). P%\^) = P%\ip) = (P% <g> P%\®)là c )^, for every a £ A. 

Second, the statistical behavior of the measurement outcomes is rewritten in terms of geomètric 
properties of the collapsed states. For a / (3 G Ao, define & a ,f3 = {(o,,b) : a = a,a + vr/2,6 = 
(3,(3 + vr/2}, and B a3 = {(P% ®P b B ® Id c )|V) : («, b) G Q>/3 ). 

Proposition 4 ( [M Y03j Prop. 2]). Let a ^ (3 G Aq. The four vectors of B a ^ are mutually 
orthogonal and have the same length as the corresponding ideal vectors ((|a)(a| ® \b)(b\)\(j) + ) : a,b G 

These geomètric properties for any a ^ (3 can be rewritten under the strong-equivalence notion. 
That is S a> p = span(B a ^) is strongly C/o^-equivalent to TÍ4, where U a> p is the isometry that maps 
P%P b B \i>) to (\a)(a\ |ò)(ò|)|c/> + > for a,b € ® a ,p. 

The third step states that in fact S a ^ = S a >fi> = S, for every ol 7^ (3', and that is 
independent from the choice of a, (3. 

Proposition 5 ([MY03, Prop. 3]). Let a,(3,a',{3' G Aq be such that a / (3 and a' / . The 

vectors of B a p are in the real span ofB a iai. Moreover, the matrix corresponding to the basis 
change from B a ^ to B a i^i is identical to the one of the ideal case. 
Lemma nf°h° ws directly from this last observation. 

The next lemma ends the proof of Theorem ^ It shows that the strong equivalence, which 
involves a global isometry U, implies the tensor equivalence over S. That is, it involves only local 
unitary transformations over A and B. Moreover the subspace S where the tensor equivalence 
holds can be extended to the tensor product of the supports of on the A-side and on the -B-side. 

Lemma 2. Let S = span((P| <8>-Pg ldc)|"0) : a,b £ A). Assume that \ip) is strongly U -equivalent 
\4> + ) on S, then there exist two unitary transformations £ U{A) and Ug £ U{B) such that \tp) 
is (Uà <8> Ug)- equivalent to \4> + ) on S. 
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The proof of this lemma is constructive, that is the transformations U A and Ug will be defined 
explicitly in terms of the projectors P A and P B . More precisely, we define the NOT and control- 
NOT using the given orthogonal projections. The transformations U A and Ug are constructed 
using the decomposition of a SWAP gate as two control-NOT gates (the logical qubit being in the 
|0) state as required by the embedding I A of A in A). It is then checked that U A and Ug fulfill the 
conclusions of the lemma. 

First, the NOT gate on A is defined by N A = 2P^ /4 - ld A . The NOT gate on A c is denoted 
by N Ac . Then, the c-NOT gates on A are defined by c Ac -N A = |0)(0| ® Id A + |7r/2><7r/2| ® Na, and 
ca-N Ac = ld Ac ® P A + N Ac ® P A 2 ■ Finally, the transformation U A which extracts the state of the 
physical qubit included in A by swapping it into A c is given by U A = (c Ac -N A )(c A -N Ac ). 

The first observation is that all these transformations are necessarily unitary since they involve 
projections that come from orthogonal measurements. Moreover, they are all equivalent to their 
ideal mapping on 5, namely to the transformations N2, c Ar -N2 and C2-N Ac , which are defined by 
substituting A with H.2- In the rest of this section we are using simultaneously many different 
spaces, hence we explicitly write the appropriate injection I A and projection P^. 

Proposition 6 ([MY03, Eq. 10]). Let I G Z(A C ,TÍ2) be the canonical isometry between A c and 
H 2 . 

1. N A (g) Ub is strongly (U, U) -equivalent to N2 M2 on S. 

2. c Ac -N A (g) is strongly (I <g) U, I <g> U)-equivalent to c Ac -N2 <8> U2 on I A (S) = \0)a c ® S. 

3. ca-Na c <8> is strongly (I ®U,I ® U)-equivalent to C2-Na c <8> U2 on Ia(S) = \0) Ac ® S. 

Therefore U A is strongly (I (g) U, I <g> ?7)-equivalent to the SWAP gate between TÍ2 and A c on 
\0)a c ® 5*. The transformation C/^ can be similarly defined on 23 with the same above properties. 

To conclude the proof, it is sufficient to check that the tensor product equivalence holds on S. 
Using the above properties of U A and Ug, this requires only a bit of àlgebra. In effect, we get 
[MY03I Eq. 11 &12]: 

\0)a c ® |0) fle ® IV) = (u\ ® ^)(|^» + )a c b c ® (^100)^)^), 

V|v?) G 5, (P4 ® Id B )M = PA(t^ ® Id s )(|a)(a|a Ac ® Id AB )(^ ® Mb^aCIv», ( 2 ) 

G 5, (Id A = P B (Id A ® C/t)(|ò)(ò|ò Bc ® Id A B)(Id^ O C^)Ib(^)). 

These equations can be summarized in the following proposition. 

Proposition 7 ([M Y031 Eq. 11 &12]). |^) is (U A (g) Ug)- equivalent to on 5. 

The tensor-equivalence can then be extended to the tensor product of the respective supports 
using [MY03I Prop. 4]. 

This ends the summary of the proof of Mayers and Yao's result. 

B.3 Robustness 

The notion of strong equivalence is extended into e-strong equivalence in the same way equivalence 
was extended into e-equivalence. In particular, for the e-strong equivalence, the subspace S does 
not need to be P^-invariant anymore. However, we require that each unit vector of P W (S) is at 
distance at most e from a vector of S. 

The proof of Theorem is again in two steps by making Lemmas robust. One way of 
stating an approximated equivalence is to derive it from an orthogonal basis using the following 
proposition. 
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Proposition 8. Let B be a finite set of orthogonal and unit vectors of H. Define S = span(-B). 
Let M and N be two linear transformations on H such that M\ip) = e N\tp) , for every \tp) 6 B. 
Then \\M - N\\ s < y/\B~\e. 

Below, S, S a fi and S'ò are defined as in the previous section. 

Lemma 3. Under the hypothesis of Theorem\Q there exists an ísometry U £ X(So,TÍ4) such that 
\ip) is strongly (O '(e 1 ' /4 ),Í7)- equivalent to \<j) + ) on S. 

Sketch of proof. We follow the structure of the proof of Lemma ^ Let 5 = y/e. First we rephrase 
Propositions |3] and ^ easily since they directly derive from the statistics of \ip). This give us 
P%\ip) = 5 P\ <g> P%\i>) and P%\ip) = s P% ® Pb\iP), f° r every a £ A. Moreover, for every a^ft the 
four states of B a p are still orthogonal but their lengths are now approximately correct up to an 
additive error 5. 

Since the sets S a g will not necessarily coincide with each other anymore, we first fix arbitrarily 
Bo = B aQj p , for some ao ^ Po, and So = S a0j p . Then we will show that any vector from S is close 
to a vector of Sq. 

Following the proof of Proposition [5J which is based on geometrical arguments in dimension 8, 
one can prové that the re-normalized vectors of B a g are now at distance at most y/6 from a vector 
of the real span of -Bo- Moreover, the basis change matrix between B a ^ and -Bo corresponds to the 
one of the ideal case up to an additive error in 0(y/d). 

We now construct U in a way similar to that of the perfect case. Because the length of the 
four vectors in Bq is not necessarily correct, U is defined after re-normalizing them. In short, 
the isometry U is the isometry that maps the (re-normalized) states P%Pg\if)) to (re-normalized) 
(\a}(a\ <g> \b}(b\)\(j) + ) for every a,b € @ ao ,g . 

The conclusions of the Lemma hold on S'ò from Proposition |SJ 

A consequence is that for every ao ^ /So £ Ao and a /= (3 £ Ao, the spaces So = S a0i g and S a ^ 
are close. For unit vectors |"0o) & So and S S a< g we have max|^ ^ mini,M |||^>o) — 1*0)11 G 0(e 1//4 ). 
This justifies that the conclusion can be extended from So to S with an additional error term in 
0{e^ 4 ). □ 

Lemma 4. Assume that \rp) is strongly (e, U)-equivalent to \4> + ) on S, then there exist two unitary 
transformations XJ a 6 U{A) and Ug £ U{B) such that \ip) is (O(e), U a <8> Ug)- equivalent to \4> + ) on 
S. 

Sketch of proof. We again follow the structure of the proof of Lemma |2J Define U a and Ug in the 
very same way. These are still unitary transformations even if the statistics are not exact. The 
first modifications start with Proposition |üj where an additive error term 2e comes from the use of 
two projections in each expression of Na, ca c -Na and C2-Na c , such that these projections are all 
5-equivalent to their ideal projections. 

1. Na <8> Ids is strongly (2e, U, U) -equivalent to ÍV2 (8> IÚ2 on So- 

2. ca c -Na <S> Ids is strongly (2e, I fg> U, 1 ® í7)-equivalent to ca c -N% (8> U2 on \0)a c <8> So- 

3. ca-Na c <8> Ids is strongly (2e, / (g> U, I í7)-equivalent to C2-Na c <8> W2 on \0)a c <8> So- 

Then Equations © are also extended up to an additive error term in O(e), which ends the 
sketch of the proof. □ 

Note that our robust statements can only be made on S. Any results that have been extended 
to the support of \ip) on the ^4-side using IM Y031 Prop. 4] cannot be made robust, at least 
independently of the dimension of A^, because of the instability of |MY03I Prop. 4]. 
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B.4 Proof of corollary 02 

We proceed by induction over n. From theorem [ül we have that |^) is e 1 / 4 -equivalent 
to \<f) + ) on span{P| n Pg n |^) : a n ,b n G A} with respect to the measurements PJJnPgn- 
Fix a n G {0,f} and b n G {§,§ + f}. Then, the state P^P^I^/HP^P^I^H is 2e- 
simulating with respect to P Ai P B \ for every 1 < i < n — 1. Applying our hypothe- 

sis for n - 1, we get that P^Pjf n |^)/||P^Pj£|'I')|| is 2 x 4 n - 1 £ 1 / 4 -equivalent to 1$+^) on 

span { (^ZI{Paí P bS) ( p a- p b«)\^) ■a i ,b i eA, 1 < i < n - l}. Note that the unitàries that 
are constructed for obtaining this equivalence are built independently from the value of a n and 
b n . Therefore, using Proposition |HJ we obtain that S = span{P|P^|í') : a, b G A n } is 4 n e 1//4 - 
equivalent to A c <g> B c with respect to &)2=i P a íP b íè Since it would have been possible to single 
out say A l (£> B 1 instead, combining the two results gives S = spanjP^Pgl^) : a, b G A n } is 
4 n e 1 / 4 -equivalent to A c ® B c with respect to P A P B - 

The fact that I*?) = 4 ™ el 4 [/^ (8> Í7g|$+}|x) can be derived from Theorem |S] applied to each 
A l (g) i? 2 pair independently. 

B.5 Proof of corollary |U 

This corollary follows directly from Theorem 03 applied to each A 1 <8) -B 1 independently when one 
recognizes that the separability condition implies that |^) = ((^í^abc-A^A^)) ® ^ t ab\^)- 

C Proof of Theorem [ü] 

The structure of the proof follows the one presented for testing 1-qubit real gates when probabilities 
are perfectly known. 

The £-simulation of (T (g) Id2")|<&^") by G A \^) can be rewritten within the density matrix for- 
malism as 

tr {{P A ®P h B ® là c )G A \^\G A ) = e tr ({\a){a\ ® \b)(b\)(T Id 2 n)|#+)($+|(Tt ® Id 2 »)) , 

for any a, b G A n . Here, \a)(a\ is a shorthand notation for (^)^_ 1 |a I )(a í |. Using that (Id2« <8> 
|6)(6|)|$+)($+| = ^\b)(b\ <g> \b)(b\ and the commutativity of the trace operator, we get 

tr((G A P%G A ®P B )\n*\) = £ ^tr(rt|a)(a|T|ò)(ò|) . 
Since Y&) is e-equivalent to we have 

tr (R a ABC (\b)(b\ Ac ® \b)(b\ Bc ® IxXxUbc) = 0{e) tr (rt|a)(a|r|ò)(6|) , (3) 

where P\g C is a positive semi-defmite operator R a ABC = (U A ®U B ®ldc)G A P A G A (U A (3U B -®Idc) 
on À® B ® C. Above, the vector \x)abc is given by the tensor e-equivalence of \^f) to 
Equation|3]can easily yield the equations required to apply Lemma[S]for performing the tomography 
oïR a A§ . For 6,6' G A 

tr (/ZSflod&X&k ® I Wk ® \x)(x\abc)) =° {£) tr (rt|a><a|r|&><ò|) . 
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Now Lemma can be applied to ABc{x\B c {b'\R^ c \b') b c \x) abc for any b' G A and its conclusion 
rewritten as q 

R ABC = A c ®Bc®\ x ) abc ( Tt | fl X a l T ) ® Id Acg.Bcg)C·· 

The e-tensor equivalence of Ga{S) with A c ® 5 C also gives (removing obvious identities): 

^ =^(5) (Vj ® 4)l«X«U c (Vk $5 Ub)- 
Using this equality we obtain 

\a)(a\ Ac (V À U È )G A {V\ ® E/t)^ ^«aSlxW rt (l«K«U c (K4 ® C^)G A (V^ ® UÍ). 
Lemma |ü] concludes that: 

G a =f {n)V ~ £ {V\ ® ® Id c )(T IcWXV^ ® C/ s ® Idc), 

which ends the proof. 



D Technical lemmas for Exact and Approximate Tomography 

Lemma 5. Let n > 1 anrf iï = ?í® n . Leí I7) òe a unit vector of H belonging to the real span of 
the states (££) í=1 |6j) for (òj)j G {0, 5 } n . Let p be a positive semi-definíte matrix over H such that 

V(&0i €{(),*§}", tr^ppMbilj = £ tr M7X7I pMkA . (4) 

Then p =2° ( " ) v / 5 | 7 )( 7 |. 

Proof Define the Pauli matrices for each factor of H as I = |0)(0| + ||}(f | = Id 2 , X = 2|f )(f | - I, 
Z = |0)(0| — |§)(f I and Y" = iZX. Recali that X, Y, and Z have trace 1, their square is I, and they 
anti-commute. A property of the n-fold tensor products of the Pauli matrices, i.e. {I, X, Y, Z}® n , 
is to be an (unnormalized) orthogonal basis for the hermitian matrices over H for the matrix inner 
product (M, N) = tr M^N. Note also that the n-fold tensor products of /, X, Z generate all real 
symmetric matrices of H by linear combination. 
That is we can write 

|7><7|= E C ( P ) P and P= E r ( P ) P > 

Pe{i,x,z}® n pç{i,x,Y,z}® n 

with c(P) = ^rtr(P| 7 )(7|) G K and r(P) = ^tr(Pp) G M. Since any P G {I,X,Z}® n is a linear 
combination of the projectors with (pi) G {0, ?,§} n , using the linearity of the trace, 

Equation ^ implies 

VP G {I,X,Z}® n , r(P) = 2 ° <n)e c(P). 

Because p is a positive semi-definite matrix, we have tr(/? 2 ) < tr(/9) 2 . Using the properties of 
Pauli matrices, the left hand side can be rewritten as tr( / o 2 ) = ^2pr(P) 2 , and the right hand side 
as r(I® n ) 2 , leading to *£p r ( p ) 2 < r{I® n ) 2 . 
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Since \p)(p\ is a projector of rank 1, it satisfies Y^p C (P) 2 = c(I® n ) 2 . Since this sum is only over 
{/, X, Z}® n , and that the coeficients c(P) are close to the coefficients r(P), we obtain r(P) 2 = 
2°(n)e, when the sum is taken over P G {/, X, Y, Z}® n - {I, X, Z}® n . 

Usingthat \p - |x)(x| || < Epll(K p ) ~ c ( p )) p l and the fact that || (r(P) - c(P))P\\ = |r(P) - 
c(P)|, we obtain that p = 2 ° (n) v / £ l 'y X'y | , which ends the proof. □ 

Lemma 6. Let n > 1 and H 1 = H 2 = 7if n . Let U £ U{H 1 ^H 2 ). Iffor every a G {0, vr/4, vr/2} n í/ie 
transformatíon U satisfies [7"(|aX a l a -ííi <8>Idff 2 ) = £ (|a)(a|aHi ®Idif 2 )£7, í/ten í/iere exists W £ U{H.2) 
such that U =2° (n) £ id Hl ® W". 

Proof. The proof uses the fact that any real symmetric matrix on H\ can be written as a linear 
combination of {\a){a\aH 1 ) a e{0,ir/4,ir/2} n ■ Since (|a)) a g{o,7r/2} ^ s the còmput ational basis of Pi, we 
can write £7 = Sije{0ir/2}™K)01 ® Wíj f° r some Wij acting on H 2 - By assumption for every í,j, 

U((\i)(j\ + IjXiI) ® Híí 2 ) = 2 ° ( " )e + UX<I) ® H Ha )tf, 

and ^(|fc)01 55 W tó + ® Wjy) = 2 ° ( " )e ^2(\i)(k\ W jfe + ÜXfcl ® W ifc ), 
fe fe 

which implies lE^- = 2°( n )e. 

Define the operator W' = ^Z-Wa. Then W' satisfies the required conditions, except that W 
is not necessarily in U(H 2 ). Since we assumed that U is a unitary transformation, one can use a 
Gram-Schmidt orthonormalization of W which will gives a W" which is at distance at most 2 0<n )e 
from W' . This concludes the proof. □ 
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